Quick answers
- Is CVE-2026-77467 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77467 being exploited in the wild.
- How severe is CVE-2026-77467?
- Informational severity, published 15 October 2026.
- Which products and versions are affected?
- LycheeOrg Lychee prior to 7.7.0.
- Is there a fix for CVE-2026-77467?
- Yes: fixed in 7.7.0. Until then: Restrict PDF upload permissions to trusted users or disable PDF upload functionality until upgrading to version 7.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-77467 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-77467?
- Check whether you run LycheeOrg Lychee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 7.7.0
Restrict PDF upload permissions to trusted users or disable PDF upload functionality until upgrading to version 7.7.0.
Technical details
The vulnerability exists in ImagickHandler::loadPdf(), which fails to enforce effective limits on PDF page dimensions before passing PDFs to ImageMagick and Ghostscript for rendering. An authenticated attacker can upload a small PDF with a maliciously large /MediaBox value in its metadata, causing Imagick::readImage() to spend substantial CPU time attempting to render the oversized page before failing. Depending on queue configuration (synchronous or asynchronous), this can block individual web workers or consume shared image-processing queue capacity.
Affected products
- LycheeOrg Lychee prior to 7.7.0
Timeline
- 2026-07-13: patched: Fix merged to master branch
- 2026-10-15: disclosed: CVE-2026-77467 published